Permission Groups Discovery: Local Groups

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download^[1]

BloodHound can collect information about local groups and members.^[2]

Caterpillar WebShell can obtain a list of local groups of users from a system.^[3]

Chimera has used net localgroup administrators to identify accounts with local administrative rights.^[4]

Cobalt Strike can use net localgroup to list local groups on a system.^[5]

Emissary has the capability to execute the command net localgroup administrators.^[6]

Epic gathers information on local group names.^[7]

Flagpro has been used to execute the net localgroup administrators command on a targeted system.^[8]

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.^[9]

Helminth has checked the local administrators group.^[10]

JPIN can obtain the permissions of the victim user.^[11]

Kazuar gathers information about local groups and members.^[12]

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.^[13]

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.^[14]

OilRig has used net localgroup administrators to find local administrators on compromised systems.^[15]

Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.^[16]

OSInfo has enumerated the local administrators group.^[17]

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.^[18]

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.^[19]

QakBot can use net localgroup to enable discovery of local groups.^[20]

SILENTTRINITY can obtain a list of local groups and members.^[21]

Sys10 collects the group name of the logged-in user and sends it to the C2.^[22]

Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.^[23]

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.^[24]